It is common to use client-server solutions for commercial applications. Hereby a separation of applications and data storage is provided. Development of applications and products for data storage and retrieval can be and is generally therefore also separated. One way of storing data is using a database as a structured and unified way of storage and retrieval. A standardized communication interface, such as SQL, is then usually used for data retrieval and storage in the databases in order to let application developers develop applications independently of the database software. In the software market of today, the development of database and application software is generally performed by different vendors.
The database vendors provides a framework and tools for storing and retrieving data, but it is up to the application developer to define the logical structure and design of the database. This is done through said communication interface. Design comprise issues like implementing the data model in tables in the database. The tables utilizes rows for representing data records and columns for different properties of a data record. Thus, a data element represent a property of a specific data record, i.e. a combination of a row and a column of a table. The restrictions and constraints of a data element in a database is defined by its type. The data type could for instance restrict which characters, the length of the data element, etc that can be stored in the database. The restrictions defined by the data type vary among the databases provided by different vendors.
In order to provide protection for data in databases, it is preferred to use a so-called granular security solution for the encryption of databases, instead of building walls around servers or hard drives. In such a solution, which is described in the document WO 97/49211 by the same applicant, a protective layer of encryption is provided around specific sensitive data-items or objects. This prevents outside attacks as well as infiltration from within the server itself. This also allows the administrator of the security solution to define which data stored in databases are sensitive and thereby focusing the protection only on the sensitive data, which in turn minimizes the delays or burdens on the system that may occur from other bulk encryption methods. Most preferably the encryption is made on such a basic level as in the data element level of the databases. Such security solutions are often provided between the database and the application intercepting the interface in between. Thus, they are transparent to the application.
However, when implementing security solutions for protecting individual data elements, such as the above described, the database design has to be adapted in order to accommodate the particular needs of a security solution. Any manipulation of the database design and structure will result in a cumbersome installation process and also increased maintenance costs. For example, if the structure of a database table has to be changed in order to accommodate an encrypted data element, this would require a costly conversion of the database table, especially if the table is populated with data. Such a change could be to introduce a new or change the properties of an existing column. Then, the interface between the application and the database has to be adapted in order to have the changed table to appear in its original form to the application in order to not violate any rules set up by the application. Then, on the other hand if the application requires a certain structure of the database and utilizes the restrictions implemented in the data type of the data element, problems are also likely to occur since for instance integrity checks will not be performed as expected by the application. Then, such checks will have to be implemented in the security solution. If then the database vendor changes their specifications of the data types or introduce new, which are also adapted by the application vendor, the security solution will also have to be amended.